EUVD-2026-35563
GHSA-7qjf-4x9r-9f46
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Use after free in Universal Plug and Play (upnp.dll) allows an unauthorized attacker to execute code over a network.
AnalysisAI
Remote code execution in the Microsoft Windows Universal Plug and Play stack (upnp.dll) allows unauthenticated network attackers to execute arbitrary code on affected hosts by triggering a memory-safety flaw in the UPnP service. The issue carries a CVSS 3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N), reflecting network reachability without credentials but high attack complexity. At time of analysis there is no public exploit identified and the CVE is not listed in CISA KEV.
Technical ContextAI
UPnP is a set of networking protocols (built on SSDP, SOAP, and HTTPU/HTTPMU) that allow devices on a LAN to discover each other and negotiate services such as port forwarding and media sharing. On Windows, this functionality is implemented in upnp.dll, which is consumed by services including SSDP Discovery (SSDPSRV) and the UPnP Device Host (upnphost). The description identifies the root cause as a use-after-free condition, while the assigned CWE-843 (Access of Resource Using Incompatible Type / Type Confusion) points to memory being reinterpreted as the wrong object type - these often co-occur when a freed object is later dereferenced through a pointer expecting a different layout, allowing control of virtual dispatch or function pointers and culminating in code execution within the UPnP service context.
RemediationAI
Apply the Microsoft security update for CVE-2026-45635 once published per the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45635 - patch status in the supplied data is 'Patch available per vendor advisory' with no exact KB cited here, so verify the specific KB for each Windows edition on MSRC before deployment. Where patching cannot be performed immediately, disable the SSDP Discovery (SSDPSRV) and UPnP Device Host (upnphost) services, which removes the vulnerable attack surface entirely at the cost of breaking media sharing, automatic device discovery on the LAN, and any application that relies on programmatic NAT port mapping. Additionally, block inbound SSDP (UDP/1900) and UPnP control traffic (typically TCP/2869 and TCP/5000) at host and perimeter firewalls and ensure UPnP is disabled on edge routers so the service is not reachable from untrusted networks; the trade-off is that some consumer gaming, VoIP, and IoT devices may need manual port forwarding configured.
More in Windows 10 1607
View allWindows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Active Directory Domain Services contains an elevation of privilege vulnerability that allows authenticated domain users
Microsoft Scripting Engine contains a type confusion vulnerability allowing unauthorized remote code execution over the
Windows CLFS Driver contains an input validation flaw enabling local privilege escalation, yet another CLFS kernel vulne
Windows Ancillary Function Driver for WinSock contains a heap-based buffer overflow enabling local privilege escalation
Windows Shell contains a protection mechanism failure (CVE-2026-21510, CVSS 8.8) that allows unauthenticated remote atta
In IGEL OS before 11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a cryptograph
Desktop Window Manager (DWM) in Windows contains a type confusion vulnerability (CVE-2026-21519, CVSS 7.8) that enables
Windows Common Log File System Driver contains another use-after-free for local privilege escalation, the latest in a se
Windows Storage contains an elevation of privilege vulnerability through symlink following that allows authorized attack
Windows Ancillary Function Driver for WinSock contains a use-after-free enabling local privilege escalation through a nu
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today